{"id":4157,"date":"2026-08-20T00:44:49","date_gmt":"2026-08-19T22:44:49","guid":{"rendered":"https:\/\/www.lablogic.pl\/?page_id=4157"},"modified":"2026-09-27T18:51:42","modified_gmt":"2026-09-27T16:51:42","slug":"michal-rutkowski","status":"publish","type":"page","link":"https:\/\/www.lablogic.pl\/en\/michal-rutkowski\/","title":{"rendered":"Micha\u0142 Rutkowski \u2014 DPO, GDPR and NIS2 expert"},"content":{"rendered":"\n
\n
\n
\n
\n
\n

EXPERT AND AUTHOR<\/p>\n\n\n\n

Micha\u0142 Rutkowski \u2014 DPO, GDPR, NIS2 and cybersecurity<\/h1>\n\n\n\n

Since 2004 I have worked at the intersection of technology, data protection and risk management. I act as an external DPO, run GDPR audits, prepare organizations for NIS2 and the Polish KSC Act, support them during incidents and breaches, and train management boards and teams. <\/p>\n\n\n\n

\n
Schedule a diagnostic conversation<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\"Micha\u0142<\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n
\n
\n

Experience and how I work<\/h2>\n\n\n\n

I am a data protection and cybersecurity practitioner and the owner of LabLogic. I work with medium and large organizations, including the financial sector and other regulated industries. I combine the legal, organizational and technological perspective: support for and fulfilment of the DPO role, preparation for NIS2 and the Polish KSC Act, incident response, audits and training. I also publish current commentary on GDPR, NIS2\/KSC and the AI Act on LinkedIn<\/a>.<\/p>\n\n\n\n

\n
\n
\n\t\n\n

Over 20 years of technological experience<\/h3>\n\n<\/div>\n\n\n\n

Practical experience working with systems, processes, vendors, and real organizational problems.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n\t\n\n

Audits and practice in breach handling<\/h3>\n\n<\/div>\n\n\n\n

Recommendations result from the analysis of events, projects, and the organization’s mode of operation.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n\t\n\n

Support for complex organizations<\/h3>\n\n<\/div>\n\n\n\n

Communication tailored to the management board and cooperation with legal, compliance, HR, and IT.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n\t\n\n

Polish and English<\/h3>\n\n<\/div>\n\n\n\n

Ability to work with documentation, teams, and stakeholders in both languages.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

Areas where I can help<\/h2>\n\n\n\n

Choose the area that matches your organization\u2019s situation.<\/p>\n\n\n\n

\n
\n
\n

DPO and GDPR<\/h3>\n\n\n\n

External DPO, support for your current data protection officer, a GDPR audit and ongoing advice for the board and the teams.<\/p>\n<\/div>\n\n\n\n

\n

Learn about DPO and GDPR services<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

NIS2 and local law KSC<\/h3>\n\n\n\n

Qualification under NIS2 and the KSC act, gap and risk analysis, a plan and support for implementation and audit readiness.<\/p>\n<\/div>\n\n\n\n

\n

Learn about NIS2 and KSC implementation<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

Incidents and breaches<\/h3>\n\n\n\n

Assessment of the situation and the risk, decisions on notifications, communication and corrective actions.<\/p>\n<\/div>\n\n\n\n

\n

See incident support<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

Training and workshops<\/h3>\n\n\n\n

Practical GDPR, NIS2 and AI Act training for boards, senior management, employees and IT and compliance teams.<\/p>\n<\/div>\n\n\n\n

\n

Learn about training and workshops<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

NEW AREA<\/p>\n\n\n\n

AI Act \u2014 a new area of my practice<\/h3>\n\n\n\n

The AI Act is settled on the same ground as GDPR and NIS2: roles, obligations, evidence. I start from what actually runs in the organisation \u2014 chatbots, assistants, anything that generates content \u2014 and establish which obligations already apply to you and which are still ahead.<\/p>\n<\/div>\n\n\n\n

See the AI Act service<\/a><\/p>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

Knowledge and insights<\/h2>\n\n\n\n

I publish current analyses and explanations in the LabLogic Knowledge Base<\/a>. Choose the category that matches the question your organization is facing.<\/p>\n\n\n\n

\n
\n
\"Illustration<\/figure>\n\n\n\n

DPO and GDPR<\/h3>\n\n\n\n

When a DPO must be appointed and how to evidence accountability.<\/p>\n\n\n\n

See the publications<\/a><\/p>\n<\/div>\n\n\n\n

\n
\"Illustration<\/figure>\n\n\n\n

NIS2 and KSC<\/h3>\n\n\n\n

Entity qualification, the scope of measures and responsibility.<\/p>\n\n\n\n

See the publications<\/a><\/p>\n<\/div>\n\n\n\n

\n
\"Illustration<\/figure>\n\n\n\n

Incidents and Breaches<\/h3>\n\n\n\n

Assessing the event, the notification decision and the first day.<\/p>\n\n\n\n

See the publications<\/a><\/p>\n<\/div>\n\n\n\n

\n
\"Illustration<\/figure>\n\n\n\n

Training and workshops<\/h3>\n\n\n\n

Who to train, how often and how to evidence the effect.<\/p>\n\n\n\n

See the publications<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

NEW AREA<\/p>\n\n\n\n

AI Act<\/h3>\n\n\n\n

Roles towards an AI system, the obligations that already apply and how to evidence them.<\/p>\n<\/div>\n\n\n\n

See the publications<\/a><\/p>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

Latest publications<\/h2>\n\n\n\n

The newest explanations and analyses from the LabLogic Knowledge Base.<\/p>\n\n\n

\n\t\n\n
\n\t\t\t
\n\t\t\t
\n\n
\"How<\/a><\/figure>\n\n
NIS2 and KSC<\/a><\/div>\n\n

How to manage supplier risk under NIS2?<\/a><\/h3>\n\n

Supply chain security under Article 8 of the Polish KSC Act covers the ICT products, services…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>

\n\n
\"What<\/a><\/figure>\n\n
NIS2 and KSC<\/a><\/div>\n\n

What NIS2 documentation must an essential or important entity keep?<\/a><\/h3>\n\n

NIS2 documentation under Article 10 of the KSC Act means normative and operational documentation together with…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>

\n\n
\"What<\/a><\/figure>\n\n
AI Act<\/a><\/div>\n\n

What new prohibitions does the AI Act introduce from 2 December 2026 and whom do they cover?<\/a><\/h3>\n\n

From 2 December 2026 the AI Act prohibits AI systems that generate realistic intimate material of…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>

\n\n
\"How<\/a><\/figure>\n\n
Incidents and Breaches<\/a><\/div>\n\n

How do you notify data subjects of a breach and what must the communication contain?<\/a><\/h3>\n\n

A breach communication is sent without undue delay to a person for whom the breach is…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>

\n\n
\"What<\/a><\/figure>\n\n
DPO and GDPR<\/a><\/div>\n\n

What resources must a data protection officer receive?<\/a><\/h3>\n\n

Article 38(2) GDPR requires the DPO to be given resources for the tasks, access to personal…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>

\n\n
\"How<\/a><\/figure>\n\n
Training and workshops<\/a><\/div>\n\n

How to document training so that it serves as evidence for the authority?<\/a><\/h3>\n\n

Training records serve best as evidence when they establish the person, the content and the day…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>

\n\n
\"How<\/a><\/figure>\n\n
Incidents and Breaches<\/a><\/div>\n\n

How to count the 72 hours for notifying a personal data breach?<\/a><\/h3>\n\n

The 72-hour deadline runs from the moment the controller becomes aware of the breach, not from…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>

\n\n
\"What<\/a><\/figure>\n\n
DPO and GDPR<\/a><\/div>\n\n

What should a contract with an external data protection officer contain?<\/a><\/h3>\n\n

According to UODO, a contract with an external DPO is a service contract and not a…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>

\n\n
\"What<\/a><\/figure>\n\n
AI Act<\/a><\/div>\n\n

What does the AI literacy obligation require?<\/a><\/h3>\n\n

Article 4 of the AI Act, after the July 2026 amendment, describes the obligation through measures…<\/p>

Read the article<\/a><\/p><\/div><\/div>\n\n<\/div>\t\t<\/div>\n\t<\/div>\n\n\t\t\t

\n\t\t\tPrevious slide<\/span>\n\t\t\t\t\t\t<\/path><\/svg>\n\t\t\t\t\t<\/div>\n\t\t
\n\t\t\tNext slide<\/span>\n\t\t\t\t\t\t<\/path><\/svg>\n\t\t\t\t\t<\/div>\n\t\n\t\t\t
<\/div>\n\t\n\n\n\t<\/div>\n\n<\/div>\n<\/section>\n\n\n\n
\n
\n
\n
\n
\n

DIAGNOSTIC CONVERSATION<\/p>\n\n\n\n

Let’s start with a conversation about your organization’s needs<\/h2>\n\n\n\n

We will determine whether the appropriate first step will be an audit, formal fulfillment of the DPO function, ongoing expert support, or assistance with a breach.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

Briefly describe your situation<\/h3>\n\n\n